Last updated: September 2026

1. Introduction

This Privacy Notice explains how Sanoma processes your personal data when you access and use Sanna - Teacher Assistant as an individual teacher. It applies from the point of registration and covers all processing activities described below, including AI Generators and Grading and Feedback modules of Sanna - Teacher Assistant.

The AI Generators is a professional AI support tool designed to help teachers generate, adapt, and structure learning materials like exercises, tests and presentations aligned with national curricula. It uses closed, EU-hosted large language models within a controlled Sanoma environment.

The tool can help teachers:

    • generate curriculum-aligned exercises and variations,
    • summarise or rewrite texts,
    • differentiate materials for diverse learners,
    • plan lessons and structure learning sequences,
    • adapt content linguistically.

The system does not operate autonomously and always requires active user input.

This notice is provided to you in accordance with Article 13 of the General Data Protection Regulation (GDPR). You are encouraged to read it carefully before using Sanna - Teacher Assistant.

2. Data Controllers

The Sanoma Group entity commercialising Sanna - Teacher Assistant in your country of residence and Sanoma Pro Oy, Toolönlahdenkatu 2, 00100 Helsinki, Finland, jointly determine the purposes and means of the processing activities described in this Privacy Notice and therefore act as joint controllers within the meaning of applicable data protection legislation. (hereinafter, Sanoma).

Data subjects may exercise their rights under applicable data protection laws by contacting either joint controller.

Privacy contact: https://www.sanomapro.fi/ota-yhteytta/asiakaspalvelu/.

3. Categories of Personal Data

The following categories of personal data may be processed. Processing will be subject to the proper legal basis defined in section 4:

    • identification and account-related data (e.g. user ID, role),
    • usage and interaction data (e.g. features used, frequency of use, technical logs),
    • personalisation data necessary to adapt the service to the user's needs,
    • session and activation data (e.g. first login date, last active date, onboarding completion events),
    • error and diagnostic data (e.g. failed generation events, repeated errors, workflow abandonment signals),
    • prompt pattern data (e.g. prompting frequency, output confidence signals, unused feature interactions),
    • support and feedback data (e.g. search queries in the help centre, help article views, pseudonymised support ticket content),
    • licence and entitlement data (e.g. licence tier, usage volume, limit-reached events),
    • content usage data (e.g. volume content used within generated outputs, for royalty calculation purposes),
    • security and login pattern data (e.g. login frequency, session characteristics, device signals).
    • Teacher’s grading configuration and preferences (e.g. Test/session title, subject, level, language, student identity mode, requested copy count, learner level, marking style)
    • Teacher-linked test and grading provenance (e.g. Generator identifier, session identifier, message identifier, test/export identifier, generated test content, instructions, layout, teaching context, rubric)

Content introduced into the tool by users may also be processed in accordance with the rules communicated to users at the point of sign-up.

4. Purposes of Processing and Legal Basis

Personal data is processed for the following purposes. The legal basis applicable to each purpose is set out below in accordance with Article 13(1)(c) and Article 13(1)(d) GDPR.

4.1 Providing and Administering the Service

What we do: We process your personal data to create and manage your account, verify your licence entitlement, enable access to Sanna - Teacher Assistant, process your prompts and generate AI-assisted outputs, track your usage against applicable limits, maintain accurate links between your account, licence and billing records, and calculate royalty payments owed to authors and rights holders for content used within generated outputs.

We will send you transactional communications necessary for the administration of your subscription. These include account and licence confirmations, invoices and billing notices, subscription and renewal alerts, maintenance and incident updates, security alerts, and notices of material changes to our terms or this Privacy Notice.

Legal basis: Performance of a contract (Article 6(1)(b) GDPR) - all processing under this purpose is necessary for the provision, administration, and enforcement of your subscription agreement and the delivery of the service you have requested. Royalty management is additionally supported by legal obligation (Article 6(1)(c) GDPR) where required by applicable copyright legislation. Communications are sent on the basis of the performance of your contract with Sanoma (Article 6(1)(b) GDPR) and, where required by law, on the basis of a legal obligation (Article 6(1)(c) GDPR). They do not require your consent and cannot be opted out of whilst your account remains active. They are entirely separate from marketing communications, which are only sent where you have provided your explicit consent.

4.2 Technical Operations, Maintenance, and Accessibility

What we do: We carry out technical maintenance activities necessary to keep Sanna - Teacher Assistant operational, secure, and up to date. This includes deploying software updates, patches, and infrastructure changes; monitoring system performance and availability; resolving technical incidents; and ensuring the service meets applicable accessibility standards. We also process data to comply with legal and regulatory obligations that apply to us as a provider of digital educational services, including data retention and deletion obligations, audit requirements, and responses to lawful requests from public authorities.

Legal basis: Legitimate interests (Article 6(1)(f) GDPR) for technical maintenance, performance monitoring, and operational continuity - maintaining a functioning, updated, and accessible service is a direct and fundamental benefit to all users. Legal obligation (Article 6(1)(c) GDPR) where processing is required to comply with applicable law, including responding to lawful requests from competent authorities and meeting mandatory audit or retention requirements.

4.3 Service Security, Support, and Integrity

What we do: We implement and maintain appropriate technical and organisational security measures to protect your personal data and your account from unauthorised access, loss, alteration, or disclosure, as required by Article 32 GDPR. We monitor usage patterns and service interactions to detect failed content generations, repeated errors, and abandoned workflows so that our support team can intervene proactively. We also detect abnormal usage patterns that may indicate licence sharing, unauthorised use, automated abuse, or account compromise. Where patterns indicate a negative user experience more broadly, we analyse these to identify and resolve service failures at an early stage. Any processing related to commercial renewal objectives is documented separately in our records of processing activities.

Legal basis: Legal obligation (Article 6(1)(c) GDPR) for the implementation of appropriate technical and organisational security measures. Performance of a contract (Article 6(1)(b) GDPR) for licence enforcement, misuse detection, and proactive support - these are direct obligations under the terms of service. Legitimate interests (Article 6(1)(f) GDPR) for account security, service integrity, and the analysis of dissatisfaction patterns to improve service quality - detecting account compromise and resolving negative experiences benefits you directly and protects the integrity of the service for all users.

Right to object: You have the right to object to processing carried out on the basis of legitimate interests at any time. See Section 8 for details.

4.4 Product Improvement, Research, and Analytics

What we do: We may use pseudonymised usage data to test, evaluate, and improve Sanna - Teacher Assistant, including its accuracy, performance, and usability. We analyse where users drop off during onboarding, which features create most value, how product releases affect adoption and support demand, and what patterns in support queries and help content interactions tell us about user needs. We also carry out internal research into educational technology and AI performance, and improve the quality of self-service support content based on real search and ticket data. Names and direct identifiers are removed from support ticket data before analysis. Where outputs are genuinely anonymised, data protection law ceases to apply to them.

Legal basis: Legitimate interests (Article 6(1)(f) GDPR) - continuously improving the service, analysing its performance, and developing better tools for teachers are direct benefits to users. All analysis is carried out using pseudonymised or aggregate data wherever possible.

Right to object: You have the right to object to this processing at any time. See Section 8 for details.

4.5 Personalisation and Enablement

What we do: We adapt the service to your usage patterns, including sending useful, timely in-app messages to help you discover relevant features. We also identify where you may benefit from additional training or guidance, based on signals such as low activation, repeated errors, unused features, or low output confidence, and provide personalised training recommendations accordingly. We generate a personalised annual usage summary showing how you have used Sanna - Teacher Assistant and the value it has created for you.

Legal basis: Performance of a contract (Article 6(1)(b) GDPR) for the annual usage summary, which is part of the service you have subscribed to. Legitimate interests (Article 6(1)(f) GDPR) for in-app guidance and training needs identification, as well as “memories” feature that allows to customise the generation of the exercises - these directly benefit you by supporting effective and confident use of the service. In-app messages are generic and triggered by sign-up date and last active date only; they are not individually profiled beyond these signals.

Right to object: You may opt out of personalised in-app guidance, “memories” and training recommendations at any time without affecting your access to the service. See Section 8 for details.

4.6 Commercial Analytics and Internal Planning

What we do: We use aggregated and pseudonymised usage data for internal commercial planning purposes, including measuring AI processing costs by feature and tier, monitoring adoption at launch, and sharing high-level aggregated usage statistics with affiliated schools. Only aggregated and non-identifiable information is shared externally. We also use aggregated data to forecast operational demand, support internal revenue planning, and ensure that sufficient resource is in place for service availability at launch. Internal capacity planning to ensure that the service operates effectively at launch directly benefits users by supporting the availability, performance, and reliability of the service. Much of the information used for this purpose may not constitute personal data, as it relates to expected user volumes and onboarding timelines.

Legal basis: Legitimate interests (Article 6(1)(f) GDPR) - understanding costs, adoption patterns, and user group needs is necessary for the sustainable operation and commercial planning of the service. Processing is carried out at aggregate or pseudonymised level wherever possible.

Right to object: You have the right to object to this processing at any time. See Section 8 for details.

4.7 Commercial Communications, Conversion, and Renewal

What we do: Where you have opted in to receive marketing communications, we may use your usage and activation data to send re-engagement emails if you have been inactive, to identify whether you may be ready to convert from a trial or free plan to a paid subscription, to monitor your account health and support renewal conversations, and to identify where your usage suggests a different service tier may better meet your needs. Cohort-level analysis for conversion and renewal purposes is carried out on the basis of legitimate interests without requiring individual-level consent.

Legal basis: Legitimate interests (Article 6(1)(f) GDPR) for inactivity detection, cohort-level conversion analysis, account health monitoring, and tier recommendations - these serve both our commercial interest and your interest in receiving relevant and timely information about the service. Consent (Article 6(1)(a) GDPR) for email marketing communications, including re-engagement, commercial outreach, and upgrade recommendations sent by email.

Right to object: You have the right to object to processing carried out on the basis of legitimate interests. See Section 8 for details.

Right to withdraw consent: You may withdraw your email marketing consent at any time via the unsubscribe link in any marketing email or via your account preferences. Withdrawal will not affect the lawfulness of processing carried out prior to withdrawal and will not affect your access to the service.

4.8 Community Programmes, and Consent-Based Activities

What we do: We measure the impact of different onboarding journeys and in-product messaging on user activation and engagement. Where you have provided your consent via the cookie banner, we also measure the impact of different usage limit configurations, service tier packaging options, and pricing prompts on user behaviour and commercial outcomes. Where you have provided your explicit consent, we may also identify you as a potential participant in community activities such as advisory groups, webinars, ambassador programmes, or testimonials, and contact you with an invitation to participate.

Legal basis: Legitimate interests (Article 6(1)(f) GDPR) for onboarding and messaging experiment measurement - this directly benefits users and is within the reasonable expectation of users of a SaaS product. Consent (Article 6(1)(a) GDPR) for commercial experiment measurement (usage limits, tier packaging, pricing prompts) collected via the cookie consent banner, and for community and ambassador participation collected via an explicit opt-in preference at registration or within your profile settings.

Right to object: You have the right to object to processing based on legitimate interests at any time. See Section 8 for details.

Right to withdraw consent: You may withdraw consent for commercial experiments at any time by updating your cookie preferences via cookie settings tool. You may withdraw consent for community participation at any time by updating your preferences in your account settings or by contacting https://www.sanomapro.fi/ota-yhteytta/asiakaspalvelu/. Withdrawal will have no impact on your access to the service. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

5. Data Sharing

Access to personal data is limited to what is necessary for the purposes described in this Privacy Notice.

Personal data may be accessed by Sanoma Group entities involved in the operation, development, and evaluation of Sanna - Teacher Assistant. These entities act as data processors on behalf of the data controller and process personal data only under documented instructions and appropriate intra-group data processing agreements in accordance with Article 28 GDPR.

Personal data may also be processed by trusted third-party service providers. Key vendors involved in the processing of personal data in connection with Sanna - Teacher Assistant include: Amazon Web Services, Product Fruits; Microsoft; Snowflake; HubSpot; Selligent (); Salesforce; survey tooling (for commercial intelligence activities); support ticketing platform providers; and AI model providers including Microsoft and equivalent EU-hosted providers. All vendors act as data processors under contractual safeguards in accordance with Article 28 GDPR.

Sanoma may share aggregated statistics derived from the use of Sanna - Teacher Assistant with educational research institutions. No personal data is shared; only aggregated and non-identifiable information is disclosed.

6. Data Retention

Personal data is retained only for as long as necessary to:

    • operate and provide the service,
    • analyse results and improve the product,
    • comply with legal and regulatory obligations.

Where possible, data is anonymised or aggregated once the service has been provided or the licence terminated. Anonymised outputs are no longer subject to data protection law and may be retained indefinitely.

7. International Transfers

Sanoma processes personal data primarily within the European Economic Area (EEA). Where personal data is transferred outside the EEA, appropriate safeguards are applied in accordance with GDPR requirements, including standard contractual clauses approved by the European Commission where required. A copy of the relevant safeguards may be obtained by contacting [Add contact details of local customer care team]

8. Data Subject Rights

You have the following rights under applicable data protection laws:

    • the right to access your personal data (Article 15 GDPR),
    • the right to request rectification or erasure (Articles 16 and 17 GDPR),
    • the right to request restriction of processing (Article 18 GDPR),
    • the right to data portability, where processing is based on consent or contract performance and is carried out by automated means (Article 20 GDPR),
    • the right to object to processing based on legitimate interests (Article 21 GDPR),
    • the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects (Article 22 GDPR), and
    • the right to lodge a complaint with a competent supervisory authority.

Right to withdraw consent: Where any processing activity described in this notice is based on your consent (Article 6(1)(a) GDPR), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Details of how to withdraw consent for each specific purpose are set out in Section 4 above.

Right to object: Where processing is based on legitimate interests (Article 6(1)(f) GDPR), you have the right to object at any time on grounds relating to your particular situation. We will cease the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is necessary for the establishment, exercise, or defence of legal claims. Where you object to processing for direct marketing or commercial outreach purposes, we will cease that processing unconditionally.

You may exercise your rights or raise any questions or concerns regarding the processing of your personal data by contacting the Sanoma at: [Add contact details of local customer care team]

We will respond to your request within one calendar month of receipt. This period may be extended by a further two months where the request is complex or numerous, in which case we will inform you within one month of receipt.

Please note that where processing is necessary for the performance of your contract with Sanoma (Article 6(1)(b) GDPR), the exercise of certain rights - in particular the right to erasure or restriction - may affect your ability to continue using the service.

Also note that you have the right to lodge a complaint with the supervisory authority in the EU member state of your habitual residence, place of work, or place of the alleged infringement.

10. Changes to This Notice

This Privacy Notice may be updated from time to time. Where changes are material, we will notify you before the changes take effect. The date of the most recent update is displayed at the top of this notice. Version history is available on request.

11. Artificial Intelligence

Users are encouraged to review the Sanna TA - Transparency Notice to ensure appropriate use of the platform and to avoid submitting sensitive, personal, or otherwise inappropriate data.

12. Use of the Grading and Feedback Feature

The Grading and Feedback feature (M2) for consumers (B2C) is designed to operate without the processing of students' personal data by Sanoma. Accordingly, teachers must not upload, submit, or otherwise make available any content containing personal data relating to students.

Before using the feature, teachers are responsible for ensuring that all student personal data has been removed, anonymized, or irreversibly redacted. This includes, but is not limited to, student names, photographs, usernames, identification numbers, contact details, assessment records, free-text comments, and any other information that could directly or indirectly identify a student.

Teachers should carefully review all materials before submission to verify that no student personal data is included. Any content containing student personal data must not be entered into or processed through the feature.

13. Access

Access to Sanna - Teacher Assistant ("AI TA") may be subject to prior authentication through the Single Sign-On ("SSO") platform designated in the country where you as a teacher reside or provide educational services. As each country operates its own SSO platform independently, users must register with the relevant SSO platform where they do not already hold valid access credentials.

Registration with the applicable SSO platform is a prerequisite for accessing and using AI TA. The processing of personal data carried out in the context of such registration and authentication is governed by the privacy policy of the corresponding SSO platform, which will be made available to the user during the registration process.

Sanoma receives from the SSO only the data elements necessary to verify your identity and enable access to the service, such as a user identifier, email address, and role. This data is processed on the basis of the performance of your contract with Sanoma (Article 6(1)(b) GDPR).

14. Cookies and Similar Technologies

Sanna - Teacher Assistant uses cookies and similar technologies to ensure the proper functioning of the service and to support the objectives described in this Privacy Notice.

Some cookies are strictly necessary for the functioning of the service and are placed without your consent. Other cookies - in particular those used for commercial experiment measurement, including pricing prompt and tier packaging experiments - are placed only with your explicit consent via the cookie consent banner. You may update your cookie preferences at any time via the cookie settings tool. Withdrawing consent for non-essential cookies will not affect your ability to access the core service.

Cookies and similar technologies are used for the following purposes:

    • to enable and secure access to Sanna - Teacher Assistant,
    • to ensure the technical functionality and performance of the service,
    • to analyse usage and support service improvement,
    • to support personalisation features, and
    • to measure the impact of commercial experiments, including usage limit configurations, tier packaging options, and pricing prompts, where you have provided your consent.

All cookies used by Sanna - Teacher Assistant are first-party cookies. No third-party cookies are used.

Cookies used in connection with the service are retained for a limited period (13 months) and in accordance with applicable legal requirements.